Security of Family Accounts

My reading of the recovery procedure for an account is that when it's initiated an email is sent to the owner of the account to initiate the recovery. I assume that the email can only go to the email address of record for the account, and that the organizer can't change the email address of record for an account, otherwise the organizer could take over an account, right? It seems that if someone intercepted that email or took over the email account then they could take over the 1Password account, right?

@MikeA01730: That's all correct.

It seems that to implement the account recovery feature each Master Password must be stored somewhere, while with an individual account they're not. If so then that seems like an inherently less secure design than an individual account which never stores the Master Password anywhere. Where are Master Passwords stored? How is access to them controlled? Might this allow 1Password (or a crazy employee) unauthorized access an account?

That's all incorrect. The Master Password is never stored. The Master Password and Secret Key are never even transmitted to us. They are used to generate a cryptographic secret on the local device which can then be verified by the server so that the server never needs to actually know the account credentials. Individual accounts, families, and teams all have exactly this same security. The way sharing works is that the equivalent of "public keys" are exchanged between family/team members during account creation, to facilitate decrypting any shared data later on. Individual accounts still have all of this, but since there is no one to exchange the keys with, there is no way to share (except with oneself...) I'd encourage you to check out the security white paper, as it goes into a lot of details about the (many) keys and how they interact:

https://1pw.ca/whitepaper

I understand that the benefit of account recovery and other Family account features is significant and may well be worth a minor reduction in security. I'm not criticizing any design decisions, I just want to understand the trade-offs that have been made.

The risk you need to be aware of is that email is not a secure channel. So we always recommend initiating recovery requests "in person". Otherwise someone malicious could trick you into putting someone's account into recovery mode, and potentially intercept the email to do it themselves. I hope this helps. Be sure to let me know if you have any other questions! :)

Hey, thanks for asking, and for reading it! Here if you need anything else. :chuffed:

@MikeA01730

It isn't possible to merge or split accounts. Anything like that would need to be done by the customer(s) manually.

Ben

@MikeA01730: Exactly. It's easiest to do in the desktop apps, but all that is needed is to be signed into both accounts and then move the items from one to another. If the person has multiple vaults, creating those in the new account first will make it easy -- just a matter of copying data from Personal* vault in individual account to Private* vault in family account, and so on with any others. :)

*These serve the same function; we just didn't think it made sense to name the vault in an individual account "Private" since everything is there. ;)